Vision Token Manipulation Attacks on Cloud-Edge Inference of Large Vision-Language Models

Technical Summary: Vision Token Manipulation Attacks on Cloud-Edge Inference of Large Vision-Language Models

Problem Statement
The paper addresses a critical security vulnerability in Cloud-Edge Large Vision-Language Model (LVLM) inference systems. In this architecture, resource-constrained edge devices perform lightweight visual encoding and transmit intermediate vision tokens to cloud servers, where the computationally intensive text encoder and Large Language Model (LLM) backbone reside. The authors identify the communication link between the edge and cloud as a new, unexplored attack surface. Unlike traditional attacks targeting raw visual inputs (e.g., adversarial perturbations) or text prompts, this work focuses on Vision Token Manipulation (VTM) Attacks. The core problem is that an adversary, operating in a black-box Man-in-the-Middle (MitM) setting, can intercept and manipulate a subset of these transmitted vision tokens. Because vision tokens are compact, high-dimensional representations encoding semantic content, manipulating them can disrupt the LVLM's understanding of spatial relationships and semantic cues, leading to significant inference failures without the attacker needing access to the model weights or raw image data.

Methodology
The authors propose a family of VTM-Attacks under a constrained black-box setting where the adversary has no access to the model parameters on either the edge or the cloud. The attack is subject to two primary constraints:

1. Dimensional Consistency: The manipulated tokens must maintain the original shape ($L_v \times d$) to avoid immediate detection or pipeline failure.
2. Manipulation Budget: The adversary can only modify a subset of tokens ($I$), defined by a Token Manipulation Ratio ($\rho$), to maintain stealth.

The methodology is divided into two components:

1. Naïve Attack Strategies: The authors design four baseline manipulation strategies applied to randomly selected tokens:

   • Permutation (Structure-based): Shuffles the positional arrangement of selected tokens while preserving their values, disrupting structural consistency.
   • Masking (Value-based): Zeroes out selected tokens, removing informational content.
   • Gaussian Perturbation (Value-based): Injects norm-scaled noise into selected tokens to alter their magnitude and direction stochastically.
   • Sign Flip (Value-based): Reverses the direction of selected tokens in the embedding space ($\hat{v}_i = -v_i$) while preserving their norm. This creates a large displacement in the representation space.

2. Optimization-based Token Selection: Recognizing that random selection is suboptimal, the authors propose an optimization strategy to identify the most influential vision tokens. Since direct measurement of output distribution impact is intractable in a black-box setting, they use Self-Attention Disruption as a proxy. They formulate an objective to maximize the discrepancy between the self-attention outputs of the original and manipulated tokens ($L_{SA}$). To prevent the selection bias toward high-norm tokens (which might be normalized out by downstream layers), they introduce a norm-aware regularization term ($L_{norm}$). The final objective maximizes $L_{SA} - \lambda L_{norm}$ using projected gradient ascent to determine the optimal set of tokens to manipulate, which are then attacked using the Sign Flip strategy.

Key Contributions

• Identification of a New Attack Surface: The paper formally defines the cloud-edge vision token transmission interface as a practical and vulnerable attack surface for LVLMs.
• VTM-Attack Framework: It introduces a comprehensive family of token-level attacks, including both structure-based (permutation) and value-based (masking, Gaussian, sign flip) manipulation strategies.
• Optimization Strategy: It proposes a novel optimization-based token selection method leveraging self-attention disruption and norm-aware regularization to significantly enhance attack effectiveness under limited budgets.
• Empirical Evaluation: The study provides extensive evaluations across six state-of-the-art LVLMs (ranging from 3B to 72B parameters) and four diverse benchmarks (OCRBench, MMBench, HallusionBench, MathVista).

Experimental Results
The experiments demonstrate that cloud-edge LVLM inference is highly vulnerable to VTM-Attacks, even with a low manipulation budget ($\rho = 0.1$, or 10% of tokens):

• Severity of Impact: Manipulating only 10% of tokens can reduce accuracy by up to 88.31%. For instance, on the MMBench benchmark, the Sign Flip attack reduced the accuracy of Qwen2.5-VL-72B-Instruct from 88.39% to 0.23%.
• Effectiveness of Sign Flip: Among the naïve strategies, Sign Flip consistently produced the most catastrophic degradation, often collapsing model performance to near-zero accuracy on MMBench and HallusionBench. This suggests that reversing the semantic orientation of tokens is more destructive than shuffling or masking.
• Model Robustness Variance: A significant disparity in robustness was observed between model families. Qwen2.5-VL models exhibited catastrophic degradation under various attacks, whereas InternVL3.5 models demonstrated considerably higher robustness. Furthermore, scaling laws were inconsistent; larger InternVL models were generally more robust, but this trend did not hold consistently for Qwen models.
• Optimization Gain: The optimization-based token selection strategy further amplified attack effectiveness compared to random selection. For example, on HallusionBench, the optimization strategy improved the attack success rate on InternVL3.5-4B and InternVL3.5-38B by 5.79% and 21.09%, respectively, over random selection.

Significance
The paper claims that these results reveal a critical vulnerability in the deployment of LVLMs in cloud-edge environments. The findings indicate that the communication link transmitting intermediate representations is a high-risk vector that has been largely overlooked in existing security literature, which focuses primarily on input-space attacks or text-only modalities. The study underscores that even limited, stealthy manipulations of vision tokens can fundamentally disrupt the vision-language interaction, leading to complete inference failure. This highlights an urgent need for secure transmission protocols and robust defense mechanisms specifically designed for the intermediate representation layer in distributed LVLM systems.